Vulners
Lucene search
NSKeyedUnarchiver - Info Leak in Decoding SGBigUTF8String Exploit
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | About the security content of macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra | 22 Jul 201900:00 | – | apple |
| About the security content of iOS 12.4 | 22 Jul 201900:00 | – | apple |
| About the security content of iOS 12.4 - Apple Support | 25 Jun 202007:44 | – | apple |
| About the security content of macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra - Apple Support | 25 Jun 202007:44 | – | apple |
 | Apple iOS < 12.4 Multiple Vulnerabilities | 23 Jul 201900:00 | – | nessus |
| macOS Sierra / High Sierra Multiple Vulnerabilities (Security Update 2019-004) | 26 Jul 201900:00 | – | nessus |
| macOS 10.14.x < 10.14.6 Multiple Vulnerabilities | 26 Jul 201900:00 | – | nessus |
 | CVE-2019-8663 | 15 Aug 201900:00 | – | circl |
 | Apple macOS and iOS Information Disclosure Vulnerability | 25 Jul 201900:00 | – | cnvd |
 | CVE-2019-8663 | 18 Dec 201917:33 | – | cve |
10
There is an info leak when decoding the SGBigUTF8String class using [SGBigUTF8String initWithCoder:]. This class initializes the string using [SGBigUTF8String initWithUTF8DataNullTerminated:] even though there is no guarantee the bytes provided to the decoder are null terminated. It should use [SGBigUTF8String initWithUTF8Data:] instead.
While this class is included in iMessage, it is more likely that this bug could be useful in local attacks.
To reproduce this issue:
1) Compile decodeleak.m
clang -o decodeleak -g decodeleak.m -fobjc-arc -framework CoreSuggestionsInternals -F/System/Library/PrivateFrameworks
2) Run:
./decodeleaks obj
leaked memory will be printed to the screen.
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47257.zip
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
15 Aug 2019 00:00Current
0.1Low risk
Vulners AI Score0.1
CVSS 25
CVSS 3.15.3
EPSS0.02252